coinibseprelogn[.]godaddysites[.]com

Analysis of coinibseprelogn.godaddysites.com shows a domain that has been actively flagged as a phishing infrastructure. The site is currently offline and returns an HTTP 404 status with the page title "404 Not Found," indicating that any previously hosted malicious content is no longer reachable. DNS records point to GoDaddy’s nameservers (cns1.secureserver.net, cns2.secureserver.net), and the domain resolves to the IP address 13.248.243.5, which belongs to Amazon.com, Inc. (AS16509) in the United States. The SSL certificate presented is a Go Daddy Secure Certificate Authority – G2 issued to GoDaddy.com, Inc., confirming the use of standard GoDaddy hosting services.

VirusTotal analysis records ten of ninety‑five security vendors marking the domain as malicious, providing independent corroboration of its phishing reputation. The domain is listed on at least one public security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a threat. Registration data indicates the domain was created on 18 November 2013 through GoDaddy.com, LLC, suggesting a long‑standing registration that may have been repurposed for malicious campaigns.

While the current offline status limits immediate risk, the underlying infrastructure (AWS hosting, GoDaddy DNS) remains observable and could be reactivated. Defenders should continue to block the associated IP address, maintain the domain on deny lists, and monitor for any re‑appearance of content. Ongoing vigilance is advised, especially given the multi‑vendor detection and blocklist presence, to prevent potential re‑use in future phishing operations.